WHAT IS CLAIMED IS: 



1 1 . A method of identifying service abuse, comprising: 

2 receiving an event requesting a service; 

3 creating an event identification associated with the event; 

4 incrementing a count value of a first table entry of a plurality of table entries 

5 in a screening table in response to the event identification matching an event identification 

6 associated with the screening table entry; 

7 decrementing a count value of a selected table entry of the plurality of table 

8 entries in response to the event identification failing to match an event identification 

9 associated with the selected table entry; 

10 replacing the selected table entry with the event identification associated with 

1 1 the event in response to the count of value of the selected entry equaling zero; and 

12 determining a metric value for the event firom the screening table, the metric 

13 indicating that the event is an abusive request. 

1 2. The method of claim 1, wherein the event identification corresponds 

2 with the identity of a user. 

1 3. The method of claim 2, wherein the event identification includes an IP 

2 address. 

1 4. The method of claim 2, wherein the event identification includes a user 

2 identification. 

1 5. The method of claim 1, wherein the event identification corresponds 

2 with a content value included in the event. 

1 6. The method of claim 5, wherein the content value includes at least a 

2 portion of a message, 

1 7. The method of claim 5, wherein the content value includes at least a 

2 portion of a URL. 

1 8. The method of claim 1, further including: 

2 selecting a second table entry as a new selected table entry in response to 

3 receiving the event. 
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1 9. The method of claim 1, further including: 

2 selecting a second table entry as a new selected table entry in response to the 

3 event identification failing to match an event identification associated with the selected table 

4 entry. 

1 10. The method of claim 1, further including disregarding the event in 

2 response to the metric value crossing a threshold value. 

1 11. The method of claim 1 , further including terminating a connection 

2 used to receive the event in response to the metric value crossing a threshold value. 

1 12. The method of claim 1, further including returning an error message in 

2 response to the event in response to the metric value crossing a threshold value. 

1 13. The method of claim 1, further including: 

2 determining an average metric value from the metric value and a set of 

3 previous metric values; and 

4 disregarding the event in response to the average metric value crossing a 

5 threshold value. 

1 14. The method of claim 1, wherein determining a metric value comprises: 

2 determining a first sub-metric value from the screening table; 

3 determining a second sub-metric value firom a second screening table; 

4 determining the metric value fi^om a weighted combination of the first and 

5 second sub-metric values. 

1 15. A system for identifying service abuse, comprising: 

2 a plurality of server computers each adapted to receive an event and to create 

3 an event packet in response to the event; 

4 a cluster host adapted to receive a plurality of event packets from at least a 

5 portion of the plurality of server computers and to update a master screening table in response 

6 to the plurality of event packets; and 

7 wherein the cluster host is further adapted to communicate a local screening 

8 table comprising at least a portion of the master screening table to each of the plurality of 
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9 server computers, and each of the plurality of server computers is adapted to disregard an 

1 0 event matching a portion of the local screening table. 

1 16. The system of claim 15, wherein the local screening table is a copy of 

2 the master screening table. 

1 17. The system of claim 15, wherein each event packet includes an event 

2 identification associated with a event. 

1 18. The system of claim 17, wherein the event identification corresponds 

2 with the identity of a user. 

1 19. The system of claim 18, wherein the event identification includes an IP 

2 address. 

1 20. The system of claim 1 8, wherein the event identification includes a 

2 user identification. 

1 21. The system of claim 17, wherein the event identification corresponds 

2 with a content value included in the event. 

1 22. The system of claim 21 wherein the content value includes at least a 

2 portion of a message. 

1 23. The system of claim 21, wherein the content value includes at least a 

2 portion of a URL. 

1 24. The system of claim 2 1 , wherein the content value is a hash of the 

2 content value included in the event. 

1 25. The system of claim 15, wherein the cluster host is fiuther adapted to 

2 determine a metric value for an entry of the master screening table, the metric indicating that 

3 the entry of the master screening table corresponds to an abusive request. 

1 26. The system of claim 25, wherein the cluster host is further adapted to 

2 set a block value associated with the entry in response to the metric value. 
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27. The system of claim 25, wherein the cluster host is adapted to 
determine an average metric value from the metric value and a set of previous metric values 
and to set a block value associated with the entry in response to the average metric value. 

28. The system of claim 15, wherein the cluster host is adapted to 
determine a first sub-metric value from the entry, to determine a second sub-metric value 
from an entry of a second master screening table, and to determine the metric value from a 
weighted combination of the first and second sub-metric values. 
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